In the Linux kernel’s IPv6 routing subsystem, a use‑after‑free condition occurs when a route iterator is stopped while the walker is still linked. The iterator’s private object can be freed while remaining in the list, causing subsequent route deletions to dereference a dangling pointer. This flaw permits kernel memory corruption that can lead to arbitrary code execution with elevated privileges.

The flaw exists in the Linux kernel’s IPv6 route walking implementation. All kernel releases containing the code that handles walkers in the IPv6 routing table, prior to the patch that follows this CVE, are impacted. No specific version range is listed in the advisory, so any system running a Linux kernel at the time of the fix that contains the affected code path is considered vulnerable.

The CVSS score is 7.8, and the EPSS score is less than 1%, indicating a very low exploitation probability. The vulnerability is not in the CISA KEV catalog, showing no publicly known exploits. Nonetheless, a use‑after‑free in kernel space is a high‑severity flaw that can lead to local privilege escalation. The attack vector is inferred to be local or network‑based manipulation of IPv6 routes, which could be achieved by any process with route‑management privileges.